# Suffect

> Suffect lets an AI agent sign up for the services it needs, with the human approving the vendor's terms and a budget once, by passkey. The vendor account is in the human's name, the agent gets a short-lived scoped grant instead of the key, and the record of what the human agreed to is signed by the human and by Suffect.

Every page of https://suffect.com has a Markdown twin at the same path plus `.md`, also served to a request whose Accept header prefers text/markdown. The whole site in one file is https://suffect.com/llms-full.txt. Nothing on this site needs a browser or JavaScript.

Write to hello@suffect.com about the alpha, a vendor manifest or a security problem.

## Pages

- [Suffect](https://suffect.com/index.md): Suffect lets your AI agent sign up for the APIs it needs. You approve the vendor's terms and a budget once; the account is in your name, the key expires, and what you agreed to is signed.
- [For agents](https://suffect.com/agents.md): How an AI agent gets access to a vendor through Suffect: one call, request_access, on 401, 402, 403 and "API key required"; what comes back; the eight tools; the rules; where the MCP server, the skill and the CLI are.
- [For vendors](https://suffect.com/vendors.md): Agent-originated customers with a human who agreed: what a Suffect signup looks like at your API, the manifest at /.well-known/suffect.json, the one-call signup endpoint, and how to verify Suffect's requests.
- [Manifest spec](https://suffect.com/spec.md): Suffect vendor manifest spec 0.2: discovery at /.well-known/suffect.json, the manifest, the signup request, the consent record, the attestation, request signatures, conformance and the JSON Schemas.
- [Security](https://suffect.com/security.md): How Suffect handles keys, money and consent: your agent gets proxied, short-lived access instead of keys, vendor keys stay encrypted in a vault, every approval is a record signed with your passkey, and every request its automation sends a vendor is signed.
- [SuffectRunner](https://suffect.com/bot.md): For site operators: what SuffectRunner is, the User-Agent it sends, how to verify its signed requests, what it does and never does, and how to decline.

## For agents

- [The agent skill](https://suffect.com/skill.md): the SKILL.md that tells an agent when and how to ask Suffect for access, in the Agent Skills format.
- [For agents, as Markdown](https://suffect.com/agents.md): the eight MCP tools, the statuses, the rules, where the server is.

## For vendors

- [Manifest JSON Schema](https://suffect.com/schemas/0.2/manifest.schema.json): the file a vendor publishes at /.well-known/suffect.json.
- [Signup request JSON Schema](https://suffect.com/schemas/0.2/signup-request.schema.json): what Suffect posts to a vendor's signup endpoint.
- [Consent record JSON Schema](https://suffect.com/schemas/0.2/consent-record.schema.json): what a human signed.

## Optional

- [llms-full.txt](https://suffect.com/llms-full.txt): every page and the skill in one file.